Malicious code in git-mirror-client (npm)

The package git-mirror-client was found to contain malicious code...

CLSA-2025-1755184971 git: Fix of CVE-2025-46835

CVE-2025-46835: fix vulnerability where Git GUI can create and overwrite arbitrary writable files...

git: Fix of CVE-2025-46835

CVE-2025-46835: fix vulnerability where Git GUI can create and overwrite arbitrary writable files...

Oracle Linux 7 : git (ELSA-2025-11688)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-11688 advisory. 1.8.3.1-25.0.1 - Fixed CVE-2025-48384 Orabug: 38234220 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

GHSA-X6GV-2RVH-QMP6 m00nl1ght-dev/steam-workshop-deploy: Exposure of Version-Control Repository to an Unauthorized Control Sphere and Insufficiently Protected Credentials

Summary The steam-workshop-deploy github action does not exclude the .git directory when packaging content for deployment and provides no built-in way to do so. If a .git folder exists in the target directory e.g., due to a local Git repo, custom project structure, or via the actions/checkout...

m00nl1ght-dev/steam-workshop-deploy: Exposure of Version-Control Repository to an Unauthorized Control Sphere and Insufficiently Protected Credentials

Summary The steam-workshop-deploy github action does not exclude the .git directory when packaging content for deployment and provides no built-in way to do so. If a .git folder exists in the target directory e.g., due to a local Git repo, custom project structure, or via the actions/checkout...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the ReadOneJNGImage function. An attacker can access data on the heap or cause memory corruption by tricking a user into processing a specially crafted image file. Remediation A fix was pushed into the...

Sensitive Data Exposure

@finos/git-proxy is vulnerable to sensitive data exposure. The vulnerability is due to improper validation of commits in the pack sent to GitHub, which allows an attacker to inject unreferenced commits containing sensitive data and retrieve them via direct commit URLs without appearing in the...

Improper Authorization

@finos/git-proxy is vulnerable to Improper Authorization. The vulnerability is due to improper validation of branch creation workflows due to the way GitProxy handles new branch creation, allowing attackers to bypass approval of prior commits on the parent branch...

Malicious File Parsing

@finos/git-proxy is vulnerable to malicious file parsing. The vulnerability is due to improper PACK signature detection in parsePush.ts, which allows an attacker to embed misleading signatures in commit content and craft packet structures to bypass approval or hide commits...

PT-2025-34541 · Github Actions · Boldestdungeon/Steam-Workshop-Deploy +1

Summary The steam-workshop-deploy github action does not exclude the .git directory when packaging content for deployment and provides no built-in way to do so. If a .git folder exists in the target directory e.g., due to a local Git repo, custom project structure, or via the actions/checkout...

CLSA-2025-1755008210 git: Fix of CVE-2025-46835

CVE-2025-46835: fix vulnerability where Git GUI can create and overwrite arbitrary writable files...

ROOT-OS-DEBIAN-12-CVE-2025-27614 CVE-2025-27614 in rootio-git - Patched by Root

Root has patched CVE-2025-27614 in the rootio-git package for Root:Debian:12. Multiple fixed versions available...

git security update

1.8.3.1-25.0.1 - Fixed CVE-2025-48384 Orabug: 38234220...

CLSA-2025-1754940060 Fix CVE(s): CVE-2025-27613, CVE-2025-27614, CVE-2025-46835

SECURITY UPDATE: multiple vulnerabilities in Gitk and Git GUI - debian/patches/CVE-2025-27614CVE-2025-27613CVE-2025-46835.patch: Prevent script execution via specially crafted filenames in Gitk. Sanitize filename handling to avoid unintended file creation/truncation. Validate directory names in G...

Linux Distros Unpatched Vulnerability : CVE-2024-50349

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: elvish, nvidia-nsight-compute-13.0, cortex-fips, prometheus-elasticsearch-exporter, redpanda, rancher-agent, cloudnative-pg-fips, kubernetes-csi-external-provisioner-fips, cilium-envoy-fips, velero, packer, prometheus, boring-registry, prometheus-podman-exporter,...

15,000 Jenkins Servers at Risk from RCE Vulnerability (CVE-2025-53652)

A new report by VulnCheck exposes a critical command injection flaw CVE-2025-53652 in the Jenkins Git Parameter plugin.…...

Linux Distros Unpatched Vulnerability : CVE-2025-46835

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file locat...

Linux Distros Unpatched Vulnerability : CVE-2024-52006

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to...